Research On Intrusion Detection Method With Improved Random Decision Tree

With the rapid development and extensive application of computer and Internet technology, people benefit from these so much, and at the same time, they have to face the grim challenges on information security. The vulnerability of system security, security risks by the own design of operating system, application software, network protocol and so on, all of which make the security problems by hackers and virus attacks be increasingly serious and complicated, and also cause the more and more economic losses.Intrusion detection (ID), a kind of network technology, plays an important role in network security. Introducing Data Mining (DM) technology in ID can improve its self-adaptive and self-learning ability. However, the large-scale of ID database makes many of DM models hard to be used. Therefore, Random Decision Tree (RDT) is introduced to carry out the research of ID based on DM.The main works in this dissertation is as follows:(1) The related research contents about ID technology are summarized firstly, and then the application of RDT classification model in ID is probed into deeply.(2) Aiming at the shortcoming of low classification accuracy caused by the simple methods RDT used to deal with continuous attributes, density-based clustering discretizing continuous features is introduced to improve the accuracy of RDT's dealing with continuous attributes.(3) The selection of attributes in building tree is entirely random, which inevitably reduces the ability of anti-jamming and instability of classification accuracy. Accordingly, an Attributes Significance-Based Random Decision Tree Algorithm (ASRDT) is proposed which computes the significance of attribute by Rough Set theory to improve its anti-jamming ability distinctly, and makes ASRDT not only keep the advantages of RDT, but also performance better classification accuracy and stability than the latter.(4) Both theoretical analysis and experimental result shows that the application of improved RDT model in ID has preferable space-time performance, lower rate of false and loss alarm, and a strong sense of scalability and adaptability.